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Abstract 

We study sequential collusion-resistant fingerprinting, 
where the fingerprinting code is generated in advance 
but accusations may be made between rounds, and show 
that in this setting both the dynamic Tardos scheme and 
schemes building upon Wald’s sequential probability ra¬ 
tio test (SPRT) are asymptotically optimal. We further 
compare these two approaches to sequential fingerprinting, 
highlighting differences between the two schemes. Based 
on these differences, we argue that Wald’s scheme should 
in general be preferred over the dynamic Tardos scheme, 
even though both schemes have their merits. As a side re¬ 
sult, we derive an optimal sequential group testing method 
for the classical model, which can easily be generalized to 
different group testing models. 


1 Introduction 


how these limitations can be overcome by further modi- 


fying the scheme 

24 

32 

40 to achieve asymptotic opti- 

mality | 2 
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36 

41 

. Most notably, connections were made 


between fingerprinting, game theory, channel coding, and 
statistical hypothesis testing, which ultimately allowed us 
to explain why the optimal non-adaptive designs are opti¬ 


mal mmm- 

Although various of these insights directly carry over to 
the adaptive setting, in this area several questions remain: 




Is the “dynamic Tardos scheme” 


28,30 optimal? 


• What motivates the design of this scheme? 


Answering these and related questions may ultimately 
lead to the same level of understanding for the adaptive 
case as for the non-adaptive setting, allowing practitioners 
to make well-motivated design choices in the adaptive 
setting as well. 


In collusion-resistant fingerprinting, a distributor aims to 
embed fingerprints in digital content so that even if sev¬ 
eral users collude and mix their fingerprinted copies into 
a new copy, the resulting pirate version can still be traced 
back to the guilty parties. In 2003, the seminal work of 
Tardos 54 showed that in the non-adaptive setting, fin¬ 


gerprinting codes with this property must have a length 
£ quadratic in the number of colluders c and logarithmic 
in the total number of users n (i.e., £ oc c 2 logn), and 
that such codes exist. These codes guarantee that with 
a proper decoding algorithm, at least one of the collud¬ 
ers can be found with high probability. Later, in 2013 it 
was shown 28 that in the adaptive setting, where code 


words are sent out symbol by symbol and the distributor 
is allowed to base future decisions on previous results, in 
fact all colluders can provably be found with a code length 
£ oc c 2 logn, using a dynamic version of Tardos’ scheme. 
Results in fingerprinting have recently found applications 
in other fields as well, including group testing 29 34 and 
differential privacy [8| |l3l|53||56] . 

Over the years, various follow-up works to Tardos’ mile¬ 
stone paper have allowed us to understand why Tardos’ 
scheme is designed the way it is designed [l5| 50 , how the 
scheme can be further improved theoretically 16,31 38 39 
48p)l and practically |^[IIlfl6H20l[26l|33l[35ll#l|47l, what 


are the limitations of fingerprinting in general |2[23[36 and 


of the optimized (symmetric) Tardos scheme [27, 3l]7 and 
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Contributions. In this paper we answer the second 
question by showing a connection with what is known 
in the literature as the sequential probability ratio test 
(SPRT), invented by Wald in the 1940s 58 . As a result, 


we are also able to take a first step towards answering 
the first question: within the class of sequential finger¬ 
printing schemes, where the code book is not constructed 
adaptively, both the dynamic Tardos scheme and schemes 
built from Wald’s SPRT are essentially optimal for the 
uninformed fingerprinting game. We discuss in detail 
how sequential fingerprinting schemes can naturally be 
constructed from Wald’s SPRT, and how various results 
from the literature can be used to tune these schemes 
to different scenarios. We finally compare the dynamic 
Tardos scheme to Wald’s SPRT, and highlight why in 
general Wald’s scheme should be preferred. 


Roadmap. First, in Section [2] we outline the finger¬ 
printing model considered in this paper. In Section [3] we 
briefly review the dynamic Tardos scheme and its variants. 
Then, in Section [4] we describe Wald’s sequential proba¬ 
bility ratio test procedure, and how it can be applied to 
fingerprinting to obtain optimal sequential fingerprinting 
schemes. Next, in Section [5] we illustrate the similarities 
and differences between these schemes through explicit ex¬ 
amples, on the way showing that both schemes are asymp¬ 
totically optimal for the uninformed fingerprinting game. 
Finally, in Section[6]we give an overview of the main char¬ 
acteristics of both schemes, which may allow practitioners 
to make a well-informed choice between the two schemes. 
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2 Model 

The collusion-resistant fingerprinting problem is often 
modeled as the following two-person game between the 
distributor V and the coalition of pirates C. The set of 
colluders is assumed to be a random subset of size \C\ = c 
from the complete set of n users U , and the identities of 
these colluders are unknown to the distributor. The dis¬ 
tributor might not know c either, and he may only have a 
(crude) upper bound Cq > c on c. The aim of the game for 
the distributor is to discover the identities of the colluders 
without accidentally accusing innocent users, with as lit¬ 
tle effort as possible. The colluders want to prevent this 
and remain hidden. The game consists of the following 
three phases: the distributor uses an encoder to generate 
fingerprints; the colluders employ a collusion channel to 
generate pirate output; and the distributor uses a decoder 
to map pirate output to a set of accused users. We describe 
these three phases below. 


a. Encoder The distributor generates a code X = 
{xj,..., x n }, consisting of binary code words x,- £ { 0 , l} f 
for each user j £U, and each column i £ {1 ,..., 1} corre¬ 
sponds to a different segment of the content 0 A common 
restriction on the encoding process is to assume that X 
is created by first generating a bias vector p £ [ 0 , 1 ]\ by 
choosing each entry p t independently from a certain distri¬ 
bution F, and then generating X using P((xj)j = 1) = jq. 
Schemes with this property are sometimes called bias-based 
schemes. 

As initially suggested by Tardos 54 and later proven by 
Huang and Moulin 23 , the best way to build bias-based 


encoders (for large coalitions, in the uninformed setting) is 
to use the arcsine distribution for generating p^s. For this 
distribution, we have the following distribution function 
F: 


2 

F(p) = - arcsin Jp. (p £ (0,1)) (1) 

7T 

Unless stated otherwise, throughout the paper we will as¬ 
sume that this encoder is used for generating biases. 

b. Collusion channel Given X 1 the entries can be used 
to select and embed watermarks in the content, and the 
content is sent out to the users. The colluders get together, 
compare their copies, and use a collusion channel or pirate 
strategy 0 to select the pirate output y £ {0, l} f . If the 
pirate attack is symmetrical both in the colluders and in 
the positions i, then the collusion channel can be modeled 
by a vector 6 £ [ 0 , l] c+1 , with entries 9~ = P(Yi = 1 | 
Z = z) indicating the probability of outputting a 1 when 
pirates receive z ones and c — z zeros. 

c. Decoder After the pirate output has been dis¬ 
tributed, the distributor intercepts it and applies a 
decoding algorithm to X,y, p to compute a set C C U 
of accused users. This is commonly done by assigning 
scores to users, and accusing those users whose scores 

1 More generally X is a. code with entries from an alphabet of size 
q , but here we restrict our attention to the case q = 2. 


exceed a predefined threshold rj. The distributor wins 
the game if C = C and lose^] if C 7 I C, which could 
be because an innocent user j ^ C is falsely accused (a 
false positive error), or because a guilty user j £ C is not 
accused (a false negative error). We often write e x and £2 
for (upper bounds on) the false positive and false negative 
probabilities. 


Finally, the differences between non-adaptive (static) 
fingerprinting, adaptive (dynamic) fingerprinting, and se¬ 
quential fingerprinting can be explained by showing in 
which order these phases take place. Denoting by cq, c* 
the three phases corresponding to the ith segment of the 
content, we can order the phases as follows: 

• Non-adaptive: C[i,...,q- 

• Sequential: b x ; c x ; b 2 ; c 2 ; ...; b e ; c e . 

• Adaptive: cq; b x ; c x ; a 2 ; b 2 ; c 2 ; ...; aq bf, q. 


In other words: in the adaptive setting the code can be 
adjusted and accusations can be made after every symbol; 
in sequential fingerprinting only users can be accused be¬ 
tween rounds; and in non-adaptive settings the distributor 
is only allowed to make a final decision at the end of the 
game. 

While most work in the literature focuses on the non- 
adaptive setting, some work has also been done on sequen¬ 
tial 45 and adaptive fingerprinting [5j |T4j[28j[.3 0 [| 44 [[55] . In 
this paper we will mostly deal with the sequential setting. 


3 Tardos’ scheme 

3.1 Non-adaptive scheme 


In Tardos’ original scheme [54] and many of its subse¬ 
quent variants, decoding in the non-adaptive setting is 
done as follows. First, for each segment i and user j, scores 
Sj t i = yi,Pi) are assigned using a score function g. 

Then, in the non-adaptive setting, a user j £U is accused 


iff S, 




> r] for some well-chosen threshold 77 . 


Choosing a suitable score function is crucial, and it was 
long thought that the following symmetrized version 
of Tardos’ original proposal was the best choice: 


49 


9{x,y,p) 


( Vp/Q-p) if 0uy) 
I ~Vp/( 1 -p) if ( x i y) 
I - Vi 1 p)/p if ( x i y) 
wd p)/p if ( x i y) 


( 0 , 0 ); 

( 0 , 1 ); 

( 1 , 0 ); 

( 1 , 1 )- 


( 2 ) 


This function turns out to work quite well against arbitrary 
pirate attacks, and it has the convenient property that 
regardless of the pirate strategy, one always has E (Sjj \ 
H 0 ) = 0, E (S? ti | Ho) = 1 , and £(5^ | H x ) « |, where 
the hypotheses Ho and H x correspond to: 

• Ho : user j is innocent (j ^ C). 

• H x : user j is guilty (j £ C). 

2 In this paper we consider the catch-all scenario, where not at 
least one colluder (the catch-one scenario) but all colluders should 
be found for the distributor to win the game. 
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As convenient as this decoder may be, it is known to be 
suboptimal 23 27|, with code lengths which are up to a 
factor ji t 2 ss 2.47 longer than required. Using various 
different approaches (e.g. Lagrange optimization 
Neyman-Pearson decoding 


40 


32 , Bayesian decoding 


41 


11 


MAP decoding 18], empirical mutual information decod¬ 
ing 1 36]) it was later found that there are various ways 
to construct decoders for the uninformed setting in fin¬ 
gerprinting with a better performance than the symmet¬ 
ric score function. Various of these decoders were re¬ 
cently benchmarked in 20 , indicating that different de¬ 
coders work better in different settings. For comparison 
with Wald’s SPRT we will continue the description of Tar- 
dos’ scheme using Neyman-Pearson-motivated decoders, 
as considered in e.g. 


17 32 , but other decoders consid¬ 


ered in 20 may be used as well. 


After obtaining the “evidence” x_j,y,p, the distributor 
wants to distinguish between whether user j is guilty or 
noU The Neyman-Pearson lemma tells us that the most 
powerful test to distinguish between Hq and Hi (minimiz¬ 
ing one error probability, when the other is fixed) is to test 
whether the following likelihood ratio exceeds an appropri¬ 
ately chosen threshold rj . We write /A (a) = F(A = a) for 
random variables A. 

A(Xj,y,p) = J ' -j-Tyy. (3) 

/xj,Y|p(xj,y|p,i7o) 

Taking logarithms, and noting that different positions i 
are i.i.d., testing whether a user’s likelihood ratio ex¬ 
ceeds rf is equivalent to testing whether his score Sj = 
Ei9(xj,uVi-Pi) exceeds i) = In rf for g defined as follows. 
Here we omit subscripts on X, Y and P, as the random 
variables are i.i.d. for different i,j. 


g{x,y,p) = In 


/ /.Y,y|pQE,2/|p,-ffi) 

\fx,Y\p{x,y\p,H 0 ) 


(4) 


Results of Abbe and Zheng [l] have shown that in cer¬ 
tain applications, a (generalized) linear decoder designed 
against the worst-case attack is asymptotically optimal. 
Since the worst-case attack for finite c is somewhat hard 
to compute, but is known to be close to the interleaving 
attack 18 22 ] (and asymptotically equal to it 


23), 


an 


approximation of this optimal decoder may be obtained 
by assuming the colluders used the interleaving attack 
9 = 0 i n t, defined by 


( 0 int)* = - • 
C 


(0 < z < c) (5) 

In that case, working out the probabilities for fixed c leads 


to the following score function g 32 : 


g{x,y,p) = 


ln i 1 + 4 H) 

Ml"!) 

>( i+ ¥) 


if x = y = 0 ; 
if x ^ y; 
if x = y = 1. 


( 6 ) 


3 Note that we only consider to be part of the evidence, instead 
of X . Using all of X for decoding would correspond to joint decoding; 
this is discussed later on. 



Figure 1: Tardos’ scheme with log-likelihood decoding. The green 
and red marked areas (dashed lines) indicate the range (average) of 
innocent and guilty user scores respectively. Accepting Hq or Hi 
is based on whether Sj(£) > r 7 , i.e., whether a user’s score ends up 
above or below the blue point (£, rj ). 



Figure 2: Laarhoven et al.’s sequential Tardos scheme with log- 
likelihood scores. The red decreasing line, which runs parallel to the 
dashed green line, shows when users are accused and disconnected. 


To sketch the situation of cumulative user scores and the 
accusation procedure, Figure [l] outlines the scores Sj(io) = 
Y^iLi Sj,i against *o, for «o = 0 up to the final moment of 
decision iq = i. Assuming a colluder-symmetric collusion 
channel, scores of users j £ C follow a certain random walk 
with a negative drift /x 0 < 0 and a relatively large variance 
a q, while scores of guilty users j £ C follow a random walk 
with a positive drift pi > 0 and a smaller variance af. 

3.2 Sequential scheme 

The improvement described in |28| for the adaptive set¬ 
ting does not change the code generation phase at all, 
so although it was coined the dynamic Tardos scheme, it 
may more suitably be called the sequential Tardos scheme. 
The modification compared to the non-adaptive scheme 
described above, to make better use of the sequential set¬ 
ting, is the following: instead of only cutting off users from 
the content at the very end, when their scores exceed g, we 
disconnect users as soon as their normalized scores exceed 
the normalized threshold rj. This prevents the colluder 
from contributing to the remaining parts of the content, 
and allows the distributor to find the remaining colluders 
as well. Here by normalization we refer to translating the 
scores by +£po, so that innocent users are expected to have 
an average final score of 0 . 

To illustrate the effect of this change to the scheme, Fig¬ 
ure [ 2 ] sketches the cumulative user scores in the sequential 
setting without normalization , and the new accusation cri¬ 
terion. Without normalization, the scores follow the same 
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general path as in Figure [l] and the red accusation thresh¬ 
old becomes a decreasing line, rather than a horizontal line 
As discussed in 28 , with this modification 


as m 


28 30 


one can provably find all colluders rather than only one 
with a similar provable code length as in the non-adaptive 
setting. The central result of 28 can be stated as follows. 


Theorem 1. \28^ Suppose £ and 77 are chosen in the non- 
adaptive Tardos scheme to guarantee that 

(i) with prob. at least l—£± no innocent users are accused; 

(ii) with prob. at least 1 — £2 at least one colluder is ac¬ 
cused. 


3.3.2 Universal sequential decoding 

As for the setting where c is unknown and only a crude esti¬ 
mate Co is known (or no bound is known at all), [28| Section 
V] proposed a method where each user is assigned several 
scores S^,..., based on how large the coalition is 
estimated to be, and disconnecting a user as soon as one 
of his scores crosses one of the corresponding boundaries 
W...., r]( c °\ It was noted in 28 that the scores are very 


V 

similar and the boundaries seem to correspond to a con¬ 
tinuous function 77 ( 10 ) cx Vm)- One of the open problems 
posed in 28 Section VII.B] was therefore whether schemes 
with single scores and curved boundaries are provably se¬ 
cure. 


Then, using almost the same scheme parameters as be- 
/oro0 with this sequential construction we can guarantee 
that 

(i) with pr. at least 1 —2 £i no innocent users are accused; 
(ii) with prob. at least 1 — 2e 2 oil colluders are accused. 

In practice, this means that to turn a non-adaptive 
scheme into a sequential scheme that provably finds all 
colluders, we just have to replace £1 and £ 2 by ^£1 and 
^£ 2 in the formulas for £ and 77 of the non-adaptive set¬ 
ting. Since £ only depends logarithmically on £1 and £ 2 , 
for large n and c the resulting increase in the code length 
is negligible. 


3.3 Sequential variants 


While the above sequential scheme deals well with the set¬ 
ting where c is known and users can be accused after every 


position i, the paper 28 also discussed slight variations of 


this setting, which may well appear in practice. In partic¬ 
ular, the two problems of not being able to cut off users 
after every segment i , and not knowing c, were addressed 


28 Sections IV and V]. 


3.3.1 Weakly sequential decoding 


3.3.3 Joint decoding 


Finally, another topic often considered in the fingerprint¬ 
ing literature is joint decoding [2|[4{[9{ [23l[33|[35l[36||42[|51| : 
using the entire code X , rather than only the user’s code 
word Xj, to decide whether user j should be accused. As¬ 
signing scores to tuples of users was considered before in 
but no explicit decision criterion with provable 


42 


e.g. 

results was provided, and it was left as an open problem. 


4 Wald’s scheme 

4.1 Sequential scheme 

To understand the motivation behind the sequential Tar¬ 
dos scheme, and to see how the design can possibly be 
improved, we now turn our attention to what has long 
been known in statistics literature to be a solution for hy¬ 
pothesis testing in sequential settings: Wald’s sequential 
probability ratio test (SPRT). This scheme originated in 
the 1940s [57 ,|58] , and countless follow-up works have ap¬ 
peared since, which have been summarized in many books 
on this topic [3|[10],[2TJ[25)[37|[46H58],[60] . 

Let us recall the formulation of the fingerprinting prob¬ 
lem in terms of hypothesis testing, where we want to dis¬ 
tinguish between the following two hypotheses: 


To make tracing harder, pirates may delay the pirate out¬ 
put, so that a user whose score exceeds 77 at time io can 
only be disconnected at time, say, io + B. As we are now 
quite certain that he is guilty, and since he contributed 
to segments io + 1,..., io + B, we could consider these 
segments tainted and disregard them completely for trac¬ 
ing the remaining colluders. This solution was proposed 
in 28 Section IV. A] and it was shown to lead to a moder¬ 


ate increase in the code length of (c— 1 )B. A different anal- 
Section IV.B] showed that one can also perform 


28 


ysis m 

a new study of the possible overshoot over the boundary 77 , 
due to the increase B , leading to a higher increase in the 
code length. Therefore the solution from 28, Sect. IV.A] 
should be preferred. 


4 This disregards a small technical detail regarding th e ov ershoot 
over the boundary 77 ; see the discussion of Z and Z in 28] Section 
III.C] . To be sure that the scheme still works we can disregard scores 
right after a user is removed from the system |30[ Section II] with a 
negligible increase in i. We omit details here, and only present the 
simplified result. 


• Ho', user j is innocent (j ^ C). 

• Hi : user j is guilty ( j £ C). 

Now, to decide between these two hypotheses in sequential 
settings, Wald proposed the following procedure. Let 771 
and rjo be two constants, with rji > 0 > 770 , and again let 
us use the optimal log-likelihood score function g from ([fi]) . 
Now we decide in favor of H 1 as soon as a user’s cumulative 
score exceeds 771 , and we decide to accept Hq as soon as the 
user’s score drops below 770 . As long as a user score stays in 
the interval [ 770 , 771 ], we continue testing. This accusation 
procedure is sketched in Figure [3] 

Choosing the thresholds. To understand how the pa¬ 
rameters 770 and 771 should be chosen, a connection is often 
made with the continuous-time analog of random walks, 
Brownian motions. Assuming that user scores are contin¬ 
uous, so that when a score crosses one of the boundaries 
it really hits the boundary (rather than jumping over it, 
in the discrete model), then to guarantee that an innocent 
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Figure 3: Wald’s SPRT construction. As soon as a user’s score leaves 
the interval [ 770 , ?7i], he is marked innocent (below 770 ) or guilty (above 
*71 )■ 


Figure 4: Wald’s SPRT with no early innocent decisions. Setting 
771 = ln(l/£^) guarantees that innocent users are never accused with 
probability at least 1 — while this design guarantees that £2 = 0 . 


user is acquitted with probability at least 1 — 4 and a 
guilty user is accused with probability at least 1 — 4 , the 
following choice is optimal: 

» = ,1 = ln (w i )' (7) 

To guarantee that all innocent users are acquitted and all 
guilty users are found, we need to let e\ = O(i) and 4 = 
O(-), which for large c, n means 770 ~ — Inc and 771 ~ Inn. 
For instance, writing 4 = £\/n and e' 2 = £ 2 / 0 , so that the 
probability of not accusing innocents (accusing all guilties) 
is at least 1 — E\ (1 — £ 2 ), this corresponds to taking 


770 = In 


£2/c 


1 - £1/7 


771 = In 


1 ~ £2/< 
£i/n 


( 8 ) 


There are two important issues that we need to address, 
the first of which is that we are not dealing with contin¬ 
uous user scores but discrete scores. One of the effects of 
having discrete jumps in the scores is that there may be 
a slight overshoot over one of the boundaries when a user 
is accused or acquitted; a score may cross one of the lines 
at a non-integral point so to say, and at the next measure¬ 
ment the score may significantly exceed 771 or drop below 
770 . As a result the error probabilities for the above choice 
of thresholds are not exact. A useful property of the above 
choice of parameters is that if by i\ and e 2 we denote the 
real probabilities of accusing innocent and guilty users, 


when using these thresholds 770 and 771 , we have 57 Equa¬ 
tion (3.30)] 


£l + £2 < 4 + £2- (9) 

In other words, the total error probability does not in¬ 
crease, and at most one of e\ and e 2 might increase. Al¬ 
ternatively, exact bounds on the error probabilities can be 
obtained, showing that the following slightly conservative 
choice of parameters guarantees that the error bounds are 
satisfied: 


him join in later, this colluder will incorrectly be acquitted 
early on. In this setting one could say that innocence is 
virtually impossibly to prove, while it is possible to prove 
that someone is guilty. To deal with this problem, a simple 
solution is not to use a lower threshold 770 at all. This is 
equivalent to setting e' 2 = 0, as that way we will never 
acquit a colluder. In that case, the conservative choice of 
thresholds from ([ 7 ]) can be stated as 

770 =- 00 , 771 = In (1/ej_) . (11) 


Note that in this case, the aggressive and conservative ex¬ 
pressions from 0 and fll 0 ] ) match, i.e., e\ is a tight bound 
on the probability of incorrectly accusing a single innocent 
user. This more realistic implementation of the sequen¬ 
tial probability ratio test in the uninformed fingerprinting 
game is again sketched in Figure [I] 

Optimality of the SPRT. Although reaching a deci¬ 
sion with this procedure may theoretically take a very long 
time, Wald proved that his test procedure always termi¬ 
nates 58 Appendix A], regardless of £1 and £ 2 . Further¬ 
more, if by /uo (p-i) and <Tq (af) we denote the expected 
score in one segment for innocent (guilty) users, then we 
know that with high probability, the procedure will termi¬ 
nate not long after i 0 ■ po + O(oo) (?’o • Pi + O{o\)) crosses 
the boundary 770 ( 771 ). 

More formally, Wald analyzed the expected time by 
which his procedure terminates, under either Hq or H 1 , 
and together with Wolfowitz he proved 59 that his SPRT 
is optimal in that it minimizes the expected time before 
a decision is reached, both under Hq and under Hi. Ig¬ 
noring overshoots over the boundary (i.e., assuming we 
are dealing with continuous random walks), he further de¬ 
rived explicit expressions for both these expected termi¬ 
nation times, which are stated below. In the following 
theorem, we write o?kl (a|| 6 ) = aln(|) + (1 — a)ln(^ 5 |) 
for the Kullback-Leibler divergence or relative entropy (in 
nats) between a and b. 


?7o = - In ( 1 / 4 ), 77 ! = In ( 1 / 4 ). ( 10 ) 

The second issue that we should address is that having 
a threshold 770 only makes sense if all colluders have an 
increasing score. If the colluders know about the tracing 
algorithm, and use an asymmetric pirate strategy, e.g. by 
letting one colluder be inactive at the start and letting 


Theorem 2. \5£\\59^ Suppose we have a sequential test 

procedure, for which 
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• an innocent user is accused w.p. at most 4 ; 

• a guilty user is acquitted w.p. at most s 2 ; 

• the probability of termination is 1 . 



















Let T denote the time at which a decision is reached. Then: 


E(T|ff 0 ) > —dKL(ei||l - 4 ) « , (12) 

—Mo ~MO 

E(T|ff!) > — d KL ( 4 l|l - 4 ) « ln(1/£/l) • (13) 

Mi Mi 

Furthermore, the sequential probability ratio test is a se¬ 
quential test simultaneously minimizing both E(To) and 
E(Ti), and assuming that there is no overshoot over the 
boundaries, both inequalities above are equalities for the 
SPRT. 


For large n , the per-user false positive error probability 
scales as e\ = 0(1 /n) while e' 2 = 0(1) based on the argu¬ 
ment that if the average pirate score exceeds , all pirate 
scores exceed rji [28]. We further have that 


Mi 


E(%|tfi) 


E p ^ fx,Y\p(x, y\p, Hx) In 
x,y 


fx,v\p{x,y\p,Hi) 

fx,v\p(x,y\p,H 0 ) 


(14) 

(15) 


(ln2)Ep/(X i; Y\P), 


(16) 


where I(Xi,Y\P = p) is the mutual information between 
a pirate symbol and the pirate output, as described in 
e.g. [23,32j. This leads to the following corollary. 

Theorem 3. For sequential tests satisfying the conditions 
stated in Theorem [2| we have: 


E(T|ffi) > 


log 2 » 

E P I(X i; Y\P) ' 


(17) 



Figure 5: Wald’s SPRT with truncated thresholds, guaranteeing a 
decision after at most i segments. For small both e\ and £2 will 
increase. 


the very end and to take all evidence into account before 
making any decisions at all; which exactly corresponds to 
the non-adaptive setting. 

4.2 Sequential variants 

The SPRT has received extensive attention in the litera¬ 
ture, with thorough analyses of the effects of the overshoot 
over the boundaries, slight modifications of the scheme 
(such as the truncated SPRT mentioned above), and the 
effects of using different boundaries than the horizontal 
lines in the figures above. We highlight two variants which 
we also considered for the sequential Tardos scheme, and 
we consider how joint decoding may be done with the 
SPRT. For further details we refer the interested reader 
to e.g. [3][l0][2T}[25][37][46l[58][60] . 


This result implies that in general, sequentiality does 
not lead to a decrease in the asymptotic code length; with 
non-adaptive schemes it is also possible to achieve this 
asymptotic code length 32 . The two gains of sequential 


testing are that (i) in fact all colluders, rather than at least 
one of them, can provably be caught with this asymptotic 
code length; and (ii) in practice, for finite c and n, the 
time needed to find and trace all colluders will generally 
be shorter than in the non-adaptive setting. Although the 
asymptotic code length are the same, the convergence to 
this limit is significantly faster for sequential schemes than 
for non-adaptive schemes. 

While most of the analyses and results above are based 
on running this scheme with parallel infinite boundaries, 
it is not impossible to force an early decision. As already 


4.2.1 Weakly sequential decoding 

In the setting of weakly adaptive decoding, where pirates 
delay their rebroadcast of the content (or where content 
is sent out in blocks of size B), the results based on con¬ 
tinuous approximations using Brownian motions become 
less and less accurate. For higher values of B, the over¬ 
shoot over the boundary becomes more and more signifi¬ 


cant, which was also discussed in 28 Section IV.B]; there 
the possible overshoot was parametrized by Zb — Z, and 
it was noted that exactly this overshoot causes problems. 
To deal with this problem effectively, we can again use 


described by Wald 58 Section 3.8], one might ultimately 
prefer to truncate the test procedure at some fixed time l, 
at which we make a decision similar to the sequential Tar¬ 
dos scheme, and similar to the non-adaptive setting. This 
may be done with and without a lower boundary; a sketch 
for the case with a lower boundary is given in Figure [5] 
Analyzing these variants rigorously seems difficult, even 
with Brownian approximations, but an interested reader 
may refer to e.g. one of the books on sequential testing 
listed at the beginning of this section. With truncation, 
one should ask the question whether forcing a decision by 
some fixed time £ is really important. After all, if the main 
goal is to minimize the worst-case code length i needed to 
make a decision, then it is commonly best to wait until 


the method described in 28 Section IV.A]; ignore the 
tainted segments i to which a user who is now deemed 
guilty may have contributed. Then the increase in the 
code length may again only be (c — 1 )B, which in the 
uninformed fingerprinting game is negligible with respect 
to £ oc c 2 log n. 

4.2.2 Universal decoding 

Recall that in the universal decoding setting, we assume 
that c is unknown, and only a crude bound Co c may be 
known. To deal with this, Laarhoven et al. 28 proposed 


to keep multiple scores per user, and multiple accusation 
boundaries. It was conjectured that using a single score 
for each user, and using a curved boundary function of the 
form r?i(*o) oc may be possible. 

In terms of hypothesis testing, testing whether j € C or 
j C for unknown coalition sizes c could be considered 
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a test of a simple null hypothesis Hq : H = Mo against 
a one-sided alternative H± : h > Ho- In the informed 
setting, where the collusion channel is known, we might 
know exactly what Ho is, and so such a one-sided test may 
form a solution. In that case, curved stopping boundaries 
(in particular, having a boundary of the shape r/i («o) cx 
V*o) has been suggested before; see e.g. 46 Chapter IV]. 
When using the symmetric Tardos score function rather 
than the optimized log-likelihood ratios or MAP decoders, 
this approach may work well, although the issue remains 
that it seems that no single encoder and decoder can be 
used for arbitrary c and 6: in all known cases, either the 
decoder depends on c or Co, or the encoder uses a cutoff 
which depends on c. 

To work with different score functions than Tardos’ score 
function 
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and Skoric et al.’s symmetric score func¬ 
tion 49 , where /io may be considered fixed, we need to 
circumvent the issue that hq may depend on c and the 
pirate strategy 9 as well. In the universal uninformed de¬ 
coding setting we therefore do not even know what /io is. 
Two hypotheses that may be more realistic to consider are 
Hq : /i < 0 against H\ : h > 0: an innocent user will have 
a negative average score, while a guilty user will have a 
positive average score. However, depending on the collu¬ 
sion strategy, the values of no and Hi may both be small or 
large. This does not really help the colluders, as decreas¬ 
ing \ho I and \hi\ also leads to a decrease in the variance of 
the scores, but it makes using a single linear decoder even 
more problematic. 

To deal with these problems, the best solution for the 
universal setting may be to use a generalized linear de¬ 
coder jl, 11 35 , and to normalize the scores during the 
decoding phase, as described in 130 . A generalized linear 
decoder is better suited for the setting of unknown c, and 
by normalizing user scores (which can be done based on 
X, p, y) we know what Ho is. Then we can again use a hy¬ 
pothesis test of the form H 0 : h = Ho against Hi : h > Ho 
as described above, where a curved boundary may be op¬ 
timal. 



Figure 6: Sobel and Wald’s decision procedure to decide between 
three hypotheses Hq , H± , H2 ■ Letting Hi denote the event that a pair 
of users contains i colluders, this leads to a joint decoding method. 


they considered the use of several stopping boundaries, 
each corresponding to a decision of accepting one of the 
hypotheses. The distribution of scores then depends on 
whether the tuple contains 0,1 or 2 colluders, as illus¬ 
trated by the green, yellow, and red highlighted curves 
in Figure [6] This procedure can be generalized to multiple 
hypotheses as well, to deal with joint decoding with c > 2. 
For details on how to choose these stopping boundaries, 
see e.g. 
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5 Wald vs. Tardos: Applications 

In the previous two sections we saw how to construct se¬ 
quential schemes based on the (dynamic) Tardos scheme, 
and based on Wald’s SPRT. Here we briefly consider possi¬ 
ble applications of both schemes, and how the two schemes 
compare. We consider three scenarios as follows: 

1. Defending against the interleaving attack. 

2. Defending against arbitrary pirate attacks. 

3. The classical group testing model. 

These settings are studied in the following subsections. 


4.2.3 Joint decoding 

Recall that in joint decoding the entire code X is taken into 


account to decide whether users should be accused. In 42 


it was considered to assign scores to tuples T of t < c 
users, after which one would like to distinguish between 
the following t + 1 hypotheses: 

• H 0 : tuple T contains no guilty users: |T PlC| = 0; 

• H\ : tuple T contains one guilty user: \T nC| = 1; 

«... 

• H t : tuple T contains t guilty users: |TFlC| = t. 


5.1 Defending against the interleaving at¬ 
tack 

When defending against the interleaving attack, which 
may be the most practical pirate strategy due to its 
simplicity and its strength, the Neyman-Pearson decoder 
of <[6j) designed against the interleaving attack 132 may 
be a good choice, even when the tracer’s estimate Co is 
With this score function, in each segment 


20 


not exact 

the average pirate score increases by Hi ~ A, while for 
innocent users we have Ho ~ ^4 which is proved in the 
appendix. 


Although not quite as well studied as the case of two hy¬ 
potheses, this topic has also received attention in SPRT 
literature, with the earliest work dating back to Sobel 
and Wald from 1949 52 . They considered the problem 


of deciding between three simple hypotheses (t = 2), and 
provided a solution as sketched in Figure [6] Using joint 
Neyman-Pearson decoder to assign scores to pairs of users, 


In Wald’s scheme, recall that we may set rji = ln(l/e^) 
conservatively where e\ is the per-user false positive proba¬ 
bility. Without using a lower threshold, setting e\ = ei/n, 
i.e., r]i = ln(n/ei) (and i ]o = — oo) guarantees that with 
probability at least 1 — gq, no innocent users are ever ac¬ 
cused, and with probability 1 all colluders are eventually 
found. We illustrate the scheme with a toy example in 
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Sj(io) 


Theorem [T] to obtain the following parameters: 



(a) Example of Wald’s scheme: Interleaving attack 


Sj(i o) 



(b) Example of Tardos’ scheme: Interleaving attack 


Figure 7: A simulation of the interleaving attack in fingerprint¬ 
ing with Wald’s SPRT (above) and the sequential Tardos scheme 
with log-scores (below). Even though it might be caused by not so 
tight parameter choices in the sequential Tardos scheme, with Wald’s 
scheme we can more easily select tight parameters and trace colluders 
faster. 


Figure [7aJ where we set the parameters as n = 1000 , 
Co = c = 10, and e\ = 10 -3 , so that 771 ~ 13.82. On 
average, it takes about 3000 segments to trace the collud¬ 
ers. 

For large n and c, this corresponds to an asymptotic 
upper threshold of 771 ~ ln 7 ^ and an expected time of 
t ~ 2c 2 Inn until all pirates have been found. This thus 
corresponds to drawing a horizontal accusation threshold 
starting at ( 0 ,Inn), and the pirates are expected to be 
found around the point ( 2 c 2 Inn, Inn). 

In the sequential Tardos scheme with log-likelihood 
scores, setting the parameters is more difficult. Various 
provable bounds on the error probabilities for given pa¬ 
rameters are not tight, leading to pessimistic estimates 
and higher thresholds and code lengths than required. One 
could also estimate the actual required code length for a 
given set of parameters directly, leading to better scheme 
parameters, but this would have to be done for each in¬ 
stance separately; if any of the parameters c, n, £ 1 , £2 then 
changes, one would have to redo the simulations or com¬ 
putations to find good practical parameters for the new 
setting. 

To illustrate how far the provable parameters are off 
from reality, we again used the toy example of Figure [7a] 
and used the provable bounds from |32j Theorem 3] and 


Ho ~ 0.00382, 


Hi ~ -0.00343, 


iK, 17 953, 77 )6.9078, 

„(o) 


m 


( 0 ) 


68.41. 


(18) 

(19) 


Note that 77 ) , the value of the boundary at i 0 = 0, is 
significantly higher than when using Wald’s SPRT. An il¬ 
lustration of how this scheme would then work in prac¬ 
tice is given in Figure |7b| In most cases the scheme finds 
all pirates after roughly 9000 segments, which although 
much less than the provable code length of £ ~ 18 000 is 
much higher than the practical code length of the SPRT 
of £ ~ 3000 segments. 

For large n and c we can again compute what the pa¬ 
rameters converge to. First, for this setting we also ob¬ 
tain an asymptotic code length of l ~ 2 c 2 In n, and this 
again corresponds to the asymptotic point ( 2 c 2 Inn, In n); 
see e.g. 32 Theorem 3, Corollary 3]. However, in the se¬ 


quential Tardos scheme this accusation threshold is a de¬ 
creasing line (cf. Figure [ 2 ]) with a slope equal to Ho ~ • 

This means that at time ig = 0, the accusation line asymp¬ 
totically starts at In n — ( 2 c 2 In n) • ^2 = 2 In n; the red 
line starts twice as high as in Wald’s SPRT, at the point 
(0, 2Inn). So although both schemes achieve the same 
asymptotic code length, even in the limit of large n and c 
these schemes are slightly different. 

In this case there are several reasons to prefer Wald’s 
SPRT approach: it is easier to choose good parameters, 
and asymptotically the accusation threshold lies lower 
than in the sequential Tardos scheme, allowing for a 
slightly faster tracing of the colluders. 


5.2 Defending against arbitrary pirate at¬ 
tacks 

For the general, uninformed fingerprinting game, where 
it is not known what collusion channel was used, the 
tracer has to use a decoder that works well against ar¬ 
bitrary collusion channels. Again, the paper of Furon and 
Desoubeaux 20 compares various of these candidate de¬ 


coders, each of which were derived through different opti¬ 
mization techniques. 

The decoder described in the previous subsection, 
designed against the interleaving attack, is capacity- 
achieving in the uninformed setting as well 32 , and so 


a similar construction as in the previous subsection may 
again be used, both in the sequential Tardos scheme and in 
Wald’s sequential scheme. As described in [30 , with this 
score function it can only be guaranteed that (hi — Ho)/&o 
is sufficiently large regardless of the collusion channel, i.e., 
it is possible to distinguish between the innocent and guilty 
distributions. However, it could be that for different col¬ 
lusion channels, both ho and Hi are smaller than when the 
interleaving attack is used. To cope with these difficul¬ 
ties, one could normalize the scores, i.e., based on y r and 
Pi, compute Ho and cr 0 for segment i, and translate and 
scale the scores so that ho and 00 are the same as f° r the 
interleaving attack. 

Alternatively, one could use a wide range of different 
methods, such as using several score functions simulta¬ 
neously; estimating the collusion channel and using this 
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estimate to choose the score function 9 17 ; using a gen¬ 
eralized linear decoder ||1 11 35 ; or settle for slightly less 
and use the suboptimal_but ‘universal’ symmetric score 
function of Skoric et al. 49 which works almost the same 
for any collusion strategy. For small collusion sizes this 


score function does not perform that poorly 20 Figure 3], 
and it might make designing the scheme somewhat easier. 


5.3 The classical group testing model 

Let us further highlight how the sequential Tardos scheme 
and Wald’s SPRT can behave very differently, by show¬ 
ing how both schemes apply to the classical group testing 
model. In group testing 12 one is tasked to identify the 


defective members C from a population U by performing 
group tests: testing a query group Q C U returns a pos¬ 
itive result if QflC A 0 and a negative result otherwise. 
Applications include blood testing for viruses, where pool¬ 
ing blood samples of several persons and testing this batch 
leads to a positive test result iff the virus is present in the 
tested batch. In terms of fingerprinting, this problem cor¬ 


responds to dealing with the all-1 attack 29 32 33 
As described in 


32 , the Neyman-Pearson approach to 


the all-1 attack in fingerprinting leads to the following op¬ 
timized decoder g: 


9{x, y) = 



if (x,y) = (0,0); 
if (x,y) = (0,1); 
if (x,y) = (1,0); 
if (x,y) = (1,1). 


( 20 ) 


Sjdo ) 



(a) Example of Wald’s scheme: All-1 attack 


Sjdo) 



(b) Example of Tardos’ scheme: All-1 attack 


Figure 8: A simulation of the classical group testing model. The 
sequential Tardos scheme offers no improvement over non-adaptive 
group testing, and again Wald’s scheme finds the defectives faster. 


Note that this function does not depend on p anymore; to 
deal with the all-1 attack, it is best to replace the ran¬ 
dom bias generation using the arcsine distribution with a 
fixed bias p ~ In the non-adaptive, simple decoding 
setting, this leads to a required code length of l ~ ” 2 , 

while in the joint decoding setting the required code length 
becomes i ~ c log 2 n, a factor In 2 less. 

In Wald’s scheme, choosing scheme parameters is done 
similarly as in Section |5.1[ If we again consider the toy 
application of c = 10, n = 1000 and = 10~ 3 (with 
£2 = 0, not using a lower boundary), then we may again set 
rji ~ 13.82 and we are ready to use the scheme. Figure [8a] 
shows an example simulation of this scheme with these pa¬ 
rameters, using the all-1 score function from ( |20[ ). For sim¬ 
plicity, we used the asymptotic approximation p = (ln2)/c 
for generating the code. 

In the sequential Tardos scheme, one would again first 
determine the point (£, rf) at which time a decision is 
taken(cf. Figure [2]), and then draw the accusation thresh¬ 
old by drawing a line towards the y-axis, parallel to the line 
with the average innocent user scores. Note however that 
with this score function, the event (cc,y) = (1,0) is impos¬ 
sible for a guilty user (if a member j £ C has (x,), : = 1, 
then by definition y* = 1 as well), and so if this event oc¬ 
curs we know for sure that this user is innocent, and we 
assign the user a score of y(l,0) = — oo. Since the proba¬ 
bility that this event occurs for innocent users is a positive 
constant, it immediately follows that p o = —oo. As a 
consequence, the accusation threshold starting from (£, rf) 


with a slope of — go = oo becomes a vertical line upwards. 
This is illustrated in Figure [8b] which shows an example 
application of the sequential Tardos scheme with the same 
parameters as in Wald’s scheme. The provable bounds 
from 32 Theorem 3] and Theorem [T] lead to £ ss 459 and 
r][ e) « 6.91. 


6 Wald vs. Tardos: An overview 

Let us conclude with a brief overview of the two solutions 
for the sequential fingerprinting game. For simplicity, we 
will compare the sequential Tardos scheme with Wald’s 
scheme without a lower boundary, as that seems to be 
the most convenient solution in fingerprinting. Note that 
although the sequential Tardos scheme is different from 
Wald’s basic description of the sequential probability ra¬ 
tio test procedure, it could be considered a variant of the 
latter; truncating the thresholds was already considered 
by Wald himself, and using different shapes for the stop¬ 
ping boundary has been discussed extensively in various 
literature on the SPRT. 

To compare some of the characteristics, Table [l] gives 
a quick summary of the various characteristics of both 
schemes. Here optimality refers to the optimality de¬ 
scribed in Theorem [2j and asymptotic optimality refers to 
the large n and large c <C n regime. Note that by setting 
£2 = 0 in Wald’s scheme, we guarantee that eventually all 
colluders are always caught. This solution of an infinite 
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Characteristic 

Wald 

Tardos 

Optimal (cf. Theorem |2j) 

/ 

X 

Asymptotically optimal 

/ 

/ 

No false negatives (£2 = 0) 

/ 

X 

Guaranteed decision at time t 

X 

/ 

Parameters to choose 

Vi 


Simple relations for parameters 

/ 

X 

Better than non-ad. gr. testing 

/ 

X 


Table 1: A quick summary of various characteristics of Wald’s SPRT 
and the sequential Tardos scheme. For Wald’s scheme we assume we 
are not using a lower boundary 770 j he., we set £2 = 0 and r )0 = — 00 . 


accusation boundary comes at the cost of not knowing in 
advance how many segments are at most needed to reach 
a decision, although in practice this does not seem to be 
an issue. As we saw in Section [5j often choosing param¬ 
eters is easier for Wald’s scheme than for the sequential 
Tardos scheme; both because fewer parameters have to be 
chosen, and because there is a simple approximate relation 
between this single parameter 771 and the error probabil¬ 
ity ci, which holds exactly if the scores behave like true 
Brownian motions. We further saw that for the sequential 
group testing setting, the sequential Tardos scheme offers 
no improvement over non-adaptive decoding (while Wald’s 
scheme does). 


Finally, as mentioned before, Wald’s scheme has already 
been studied since the 1940s, with many books appearing 
on the topic ever since [3 10, 


the sequential Tardos scheme 


21 


28 


25 37 46 58 60 , while 


was more of an ad-hoc 


construction to build a scheme that works well in adap¬ 
tive settings as well. With Wald’s scheme being easier to 
design, in many cases performing better than the sequen¬ 
tial Tardos scheme (performing optimally well), and being 
backed by decades of research on the topic (allowing prac¬ 
titioners to tweak the scheme to their needs using known 
results from the literature), it seems that Wald’s scheme is 
a more practical choice than the sequential Tardos scheme. 


In this paper we further settled an important question 
on the optimality of these schemes (i.e., both schemes are 
asymptotically optimal in the sequential setting), but one 
important open question remains: is it possible to design 
truly adaptive fingerprinting schemes that perform even 
better than these sequential designs? Or are the sequen¬ 
tial schemes discussed in this paper also optimal in the 
adaptive setting? This is left as an open problem for fu¬ 
ture work. 
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A Expected innocent scores for 
the interleaving attack 

Lemma 1. Suppose that: 

• the encoder uses the arcsine distribution encoder; 

• the collusion channel is the interleaving attack 0 int ; 

• the decoder is the interleaving log-likelihood decoder. 

Then the expected score of an innocent user (p\) in a single 

segment is asymptotically given by: 

ho = ^x, y ,p [g(x, y,p)\H 1 ] -^. (21) 

Proof. For po, we write out the expectation: 

ho = E x ,y,p [g{x, y,p ) | H/\ (22) 

r 1 dp 

Jo 7 Ts/p(l-p) 

+ 2p(l-p)ln(l-i)+(l- ! ,) 2 l„(l + ji I ^) . 

(24) 


p 2 In 1 + 


1 -P 
cp 


(23) 


Similarly, we can write out the definition of the average 
colluder score in a single segment as: 


hi = 


f 1 dp 

lo TTy/p(l~p) [ 


r i + 


i -p 
cp 


In 1 + 


1 -P 
cp 


+ 2p(l -P)(l--)ln(l-- 


+ (1-P) 2 1 + 


c(l - p) 


c 

In (1 + 


P 

c(l-p) 


(25) 

(26) 

■ (27) 


Combining these results, and merging the logarithms into 
one term, we obtain the following expression for pi — ho'- 


hi - ho = 


v / p(l-p)dp 


In 1 + 


(c- l) 2 p(l -p) 


(28) 


Since we know that pi ~ A, we need to prove that the 
right hand side is asymptotically similar to / ■ Rearrang¬ 
ing terms, we thus need to prove that 


I == J dp\/p(l -p) In ^1 + 


(c- l) 2 p(l -p) 


IT 

c 


First, using ln(l + x) < x for all x > 0, we obtain: 


I < 


cdp 


7rc 


'o (c- 1) 2 a/p(1 -p) (c-1) 2 c 


(29) 


(30) 


To get a matching lower bound, we first reduce the range 
of integration from [0,1] to [J, 1 — J] for some S > 0, noting 
that the integrand is strictly positive: 


/ > 


J ^ d p^p{l-p) In ^1 + 


(c- l) 2 p(l -p) 


. (31) 


Choosing 6 = -yg, the term inside the logarithm is small 
and the following bound is tight enough to obtain the re- 


suit: 





I" 1 S Cdp 71 

-arcsin VS 

7T 


Js (c l) 2 \/ p(l p) c 

7rc 

C 




(32) 

This 

proves that I ~ hence po ~ 

l 

2c 2 • 
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